Evaluation of Technologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals.

THIS NOTICE IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY. THIS OPPORTUNITY IS AVAILABLE ONLY TO CONTRACTORS UNDER THE PROGRAM SUPPORT CENTER (PSC/HHS) 2009 TASK ORDER CONTRACTS.

On February 16, 2009, Title XIII - Health Information Technology for Economic and Clinical Health Act (HITECH) of the American Recovery and Reinvestment Act of 2009 (ARRA) was established. The Office of the National Coordinator for Health Information Technology (ONC) within the Department of Health and Human Services is charged with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of information.

One central aspect of HITECH is the privacy and security of personally identifiable health information. Specifically, HITECH §13402(h)(2) requires that annual guidance is issued specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals (as it relates to breach notification). As such, this contract will be a key aspect of HHS' continued effort to address these efforts. This contract will identify and assess technologies and methodologies that allow individually identifiable health information to be rendered unusable, unreadable, or indecipherable to unauthorized individuals. This statement of work directs the contractor to:
1. Identify existing and emerging technologies and methodologies that allow individually identifiable health information to be rendered unusable, unreadable, or indecipherable to unauthorized individuals.
2. Once relevant technologies are identified, assess, using scientifically valid methods, the effectiveness of these technologies and methodologies, including the ability and ease of re-identifying information.
3. Deliver to the Contracting Officer's Technical Representative (COTR) a 508 compliant report that provides an overview of the work and provides detail into the identification and testing of relevant technologies. The final report shall be no longer than thirty (30) pages in length, exclusive of any charts or supporting materials.